CVE-2026-47719Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data reachable from the FUXA host, including when secureEnabled is true. This issue is fixed in version 1.3.2.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-08-18); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-18	2	Disclosure1General1
2026-08-19	1	Disclosure1

Full discourse3 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters45d
Disclosure
CVE-2026-47719 - Critical SSRF in FUXA SCADA/HMI. Unauthenticated attackers can probe internal networks via axios. CVSS 8.2. Unpatched - restrict access now. #CVE #ICS #cybersecurity https://www.valtersit.com/cve/CVE-2026-47719 #CVE #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #iceland #israel
Post summary
A critical SSRF vulnerability (CVE‑2026‑47719) in FUXA SCADA/HMI enables unauthenticated internal network probing via axios, rated CVSS 8.2, and users are urged to restrict access while a patch is pending.
0000059
1.0K followersView on X
Infoflowcloud@infoflowcloud46d
General
🚨*CVE* CVE-2026-47719 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY https://Socket.IO handlers in server/r… https://www.cve.org/CVERecord?id=CVE-2026-47719 ----- Traducción: CVE-… https://infoflow.cloud`
Post summary
The tweet merely references CVE-2026-47719 with a link to the CVE record, offering no substantive details about exploitation, patching, or technical specifics.
0000023
100 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-47719 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY https://Socket.IO handlers in server/r… https://www.cve.org/CVERecord?id=CVE-2026-47719
Post summary
The tweet briefly announces CVE-2026-47719 for FUXA software, noting affected Socket.IO handlers prior to version 1.3.2, but provides no further exploitation, patch, or technical detail.
00000758
58.0K followersView on X

Explore more

Back to dashboard